{"id":584826,"name":"MITRE Explorer","description":"Threat intelligence agent for MITRE ATT&CK, ATLAS, CVE vulnerabilities, and application security. Query techniques, threat groups, campaigns, software, CVEs (with EPSS exploit-probability scoring), CAPEC attack patterns, GHSA + OSV advisories (OSS packages, OS, distros, kernel, Android), detection strategies, and compliance mappings across Enterprise, ICS, Mobile, and ATLAS domains. The same tools are also served over MCP at https://mitre-explorer.org/api/mcp: no key, no sign-up, no fixed rate limit.","card_url":"https://mitre-explorer.org/.well-known/agent-card.json","endpoint":"https://mitre-explorer.org/api/a2a","protocol_version":"1.0","first_seen":"2026-11-09T22:36:48.317556+00:00","last_verified":"2026-11-09T22:36:48.317556+00:00","card":{"id":"mitre-explorer","url":"https://mitre-explorer.org/api/a2a","name":"MITRE Explorer","skills":[{"id":"cve-lookup","name":"CVE Vulnerability Lookup","tags":["cve","vulnerability","security","cvss","epss","capec","osv","cisa-kev"],"examples":["What is CVE-2024-3400?","Show me critical CVEs affecting Apache HTTP Server","What new CVEs were published in the last 7 days?","Which CVEs are linked to technique T1190?","What is the EPSS score for CVE-2021-44228?","Which CAPEC attack patterns apply to CVE-2024-3400?","Which Linux / Debian / Ubuntu distro advisories reference CVE-2024-1086?"],"description":"Search and retrieve CVE vulnerability details including CVSS scores, severity, CWEs, EPSS exploit-probability scores (First.org, daily refreshed), CAPEC attack patterns, affected applications, linked ATT&CK techniques, CISA KEV status, GHSA package advisories, and OSV OS/distro advisories (Linux kernel, Debian, Ubuntu, Alpine, Android, Rocky, Alma, SUSE, OSS-Fuzz) that alias the CVE. Covers more than 398,000 CVEs, 1999 on."},{"id":"technique-intelligence","name":"ATT&CK Technique Intelligence","tags":["technique","attack","atlas","detection","sigma","d3fend","capec"],"examples":["What groups use T1059 Command and Scripting Interpreter?","Give me Sigma rules for T1566 Phishing","What are the D3FEND countermeasures for T1190?","Show me ATLAS technique AML.T0051","Which CAPEC attack patterns map to T1190?"],"description":"Get detailed intelligence on ATT&CK and ATLAS techniques: threat groups using them, Sigma detection rules, Atomic Red Team tests, D3FEND countermeasures, affected applications, NIST 800-53 control mappings, and CAPEC attack patterns mapped to the technique."},{"id":"hunt-card","name":"Threat Hunting Card","tags":["hunt","threat-hunting","detection","sigma","atomic","soc"],"examples":["How do I hunt for T1059 Command and Scripting Interpreter on Windows?","Give me a hunt card for T1566 Phishing","Which logs should I collect to detect T1190?"],"description":"One hunting card per ATT&CK technique: a starting hypothesis built from ATT&CK data by a fixed template, the logs to collect, detection strategies and analytics, the top Sigma rules, one Atomic Red Team test to check the detection, indicators from the last 14 days and recent reports. A parent technique includes its sub-techniques. ATT&CK techniques only, not ATLAS."},{"id":"threat-group-profile","name":"Threat Group Profile","tags":["threat-group","apt","adversary","actor"],"examples":["What techniques does APT29 use?","Which groups target the financial sector?","Show me the profile of Lazarus Group","Compare APT28 and APT29 techniques"],"description":"Retrieve threat actor group profiles with their techniques, targeted sectors, software used, campaigns, and targeted applications. Covers more than 180 ATT&CK groups plus more than 500 ETDA/ThaiCERT external actors."},{"id":"application-security","name":"Application Vulnerability Assessment","tags":["application","software","cpe","vulnerability","attack-surface"],"examples":["What CVEs affect LiteLLM?","Show the attack surface for Microsoft Windows Server 2022","Which threat groups target Apache Tomcat?"],"description":"Check the security posture of more than 119,000 vendor products. Returns CVEs, CWE weakness profile, reachable ATT&CK techniques, and associated threat groups via the CVE-CWE-CAPEC-ATT&CK chain."},{"id":"sector-threat-landscape","name":"Sector Threat Landscape","tags":["sector","industry","threat-landscape"],"examples":["What groups target the healthcare sector?","Show the threat landscape for financial services","Which techniques are most used against energy sector?"],"description":"Analyze threats to industry sectors: groups targeting the sector, their techniques, campaigns, vulnerable applications, and associated CVEs. Covers 12 sectors including Financial, Healthcare, Government, Energy, Telecom."},{"id":"attack-statistics","name":"ATT&CK Statistics","tags":["dashboard","statistics","attack","overview"],"examples":["How many techniques and groups does ATT&CK have?","Which ten techniques do live groups use most?","Show ATT&CK statistics for the ICS domain","Which ATT&CK version is loaded?"],"description":"ATT&CK in numbers: technique, group, software, campaign, mitigation and data source counts, the top groups, the ten techniques live groups use most, the sector breakdown and the loaded ATT&CK version. Filtered by domain or sector. ATT&CK entities only: no CVE, advisory or CAPEC totals."},{"id":"detection-search","name":"Detection & Compliance Search","tags":["sigma","detection","nist","compliance","d3fend","atomic","cis-controls"],"examples":["What Sigma rules detect credential dumping?","Show NIST controls for T1078 Valid Accounts","What Atomic tests exist for T1059?","List Azure cloud controls for T1190","Which of APT29's techniques have no CIS IG1 Safeguard mapped?"],"description":"Search Sigma rules (3,100+), Atomic Red Team tests (1,900+), D3FEND countermeasures (156), NIST 800-53 controls (5,200+), MITRE Engage mappings, VERIS mappings, and cloud security controls for Azure and GCP. Lists CIS Controls v8.1 (8.1.2) Safeguards with their Implementation Groups, as CIS maps them to ATT&CK in the CIS Community Defense Model (CDM) v3.0, and the CIS gaps of an ATT&CK group or technique list: each technique under the lowest Implementation Group whose Safeguards mitigate it, else notMitigated or notAssessed. CIS text and CIS's ATT&CK mapping: CC BY-NC-ND 4.0, non-commercial use only, attribution required. CIS titles and descriptions are served exactly as the CDM v3.0 workbook writes them; cisSource carries the source, license and attribution."},{"id":"cti-reports","name":"Threat Intelligence Reports","tags":["cti","threat-report","otx","ioc"],"examples":["Show me the latest threat reports","What threat reports are linked to technique T1059?"],"description":"Access recent CTI reports from AlienVault OTX, DFIR Report, Unit42, Microsoft Security, and Talos. Reports are mapped to ATT&CK techniques with IOC indicators."},{"id":"entity-search","name":"Cross-Domain Entity Search","tags":["search","entity","cross-domain"],"examples":["Search for phishing","Find all entities related to Mimikatz","What entities match 'remote code execution'?"],"description":"Search across all entity types (techniques, groups, software, campaigns, mitigations, data sources, applications) in all domains (Enterprise, ICS, Mobile, ATLAS)."},{"id":"software-analysis","name":"Malware & Tool Analysis","tags":["malware","tool","software","cobalt-strike"],"examples":["What techniques does Cobalt Strike use?","Search for ransomware tools","Which groups use Mimikatz?"],"description":"Search and profile 971 malware families and attacker tools. Get techniques, groups using them, campaigns, and platform coverage."},{"id":"campaign-intelligence","name":"Campaign Intelligence","tags":["campaign","operation","timeline"],"examples":["What was Operation ShadowHammer?","Show campaigns targeting the financial sector","List recent campaigns by APT29"],"description":"Search and analyze 61 named campaigns with timelines, techniques, software, and threat groups involved."},{"id":"mitigation-guidance","name":"Mitigation Guidance","tags":["mitigation","defense","countermeasure"],"examples":["How do I mitigate T1059 Command and Scripting?","What mitigations exist for credential theft?","Show me network-based mitigations"],"description":"Search 153 mitigations and get specific countermeasure guidance for ATT&CK techniques."},{"id":"tactic-profile","name":"ATT&CK Tactic Profile","tags":["tactic","attack","technique"],"examples":["Which techniques sit under TA0001 Initial Access?","Show the ICS tactic TA0106 Impair Process Control"],"description":"One ATT&CK tactic: its description, its domain and every live technique and sub-technique under it. Deprecated tactics are flagged."},{"id":"data-source-profile","name":"ATT&CK Data Source Profile","tags":["data-source","data-component","detection","telemetry"],"examples":["What can the Process data source DS0009 detect?","Which data components does DS0017 Command have?"],"description":"One ATT&CK data source: its description, its data components and the techniques it can detect. ATT&CK has marked every data source deprecated since v18. Components are matched to their source by name."},{"id":"ioc-feed","name":"IOC Feed Search","tags":["ioc","indicator","hash","ip","domain","virustotal"],"examples":["Show me IOCs from the last 24 hours","Search for Emotet IOCs","What malicious hashes were reported today?"],"description":"Search more than 230,000 IOCs (IPs, domains, hashes, URLs, CVEs) with VirusTotal verdicts and malware family attribution. Sources: OTX, ThreatFox, MalwareBazaar, CISA KEV."},{"id":"sigma-rules","name":"Sigma Detection Rules","tags":["sigma","detection","siem","rule"],"examples":["Sigma rules for credential dumping","Show critical Sigma rules for T1059","Find Sigma rules for PowerShell abuse"],"description":"Search 3,100+ Sigma rules by keyword, technique, or severity. Get YAML rule details for SIEM deployment."},{"id":"atomic-red-team","name":"Atomic Red Team Tests","tags":["atomic","red-team","emulation","testing"],"examples":["Atomic tests for T1059 on Windows","Show me Linux persistence tests","What tests exist for lateral movement?"],"description":"Search 1,900+ Atomic Red Team tests for adversary emulation. Filter by technique, platform, and executor type."},{"id":"external-actors","name":"External Threat Actor Profiles","tags":["actor","attribution","country","state-sponsor"],"examples":["Show me Russian state-sponsored actors","What is known about Lazarus Group?","List actors targeting critical infrastructure"],"description":"Search more than 500 threat actors from ETDA/ThaiCERT with country attribution, state sponsors, motivation, suspected victims, and MITRE ATT&CK group mappings."},{"id":"owasp-top10","name":"OWASP Top 10 Analysis","tags":["owasp","top10","web-security","appsec","compliance","ml-security","llm-security","ai-risks"],"examples":["Show me the OWASP Top 10 categories","What techniques relate to OWASP A01 Broken Access Control?","Which CVEs are linked to OWASP Injection (A03)?","Map OWASP A07 Authentication Failures to ATT&CK","Show me the ML Top 10 AI security risks","Which ATLAS techniques map to LLM01 Prompt Injection?","Compare Web and LLM OWASP supply chain risks"],"description":"Get OWASP Top 10 categories for Web (2021), ML (2023), and LLM (2025) security risks mapped to ATT&CK + ATLAS techniques via CWE."},{"id":"ghsa-lookup","name":"GitHub Security Advisory Detail","tags":["ghsa","github","advisory","appsec","vulnerabilities","supply-chain","capec"],"examples":["Show me GHSA-jfh8-c2jp-5v3q","What does GHSA-m3wx-6f6g-9mvv affect?","Get the GitHub advisory for the log4shell vulnerability","Which CAPEC attack patterns apply to GHSA-jfh8-c2jp-5v3q?"],"description":"Get full details for a GitHub Security Advisory: summary, description, CVSS v3/v4, CWEs, CAPEC attack patterns, affected open-source packages with vulnerable/fixed version ranges, linked ATT&CK techniques."},{"id":"package-vulnerabilities","name":"Package Vulnerabilities","tags":["packages","npm","pypi","go","maven","supply-chain","appsec","vulnerabilities"],"examples":["Which vulnerabilities affect npm/log4js-node?","Show me GHSAs for pypi/django","Is maven/org.apache.logging.log4j:log4j-core vulnerable?","What CVEs affect the go package github.com/containerd/containerd?"],"description":"List vulnerabilities affecting a specific open-source package in an ecosystem (npm, pypi, go, maven, rubygems, nuget, composer, rust). Returns all GHSAs with vulnerable/fixed version ranges and linked ATT&CK techniques."},{"id":"ghsa-search","name":"Search GitHub Security Advisories","tags":["ghsa","github","advisory","search","vulnerabilities"],"examples":["Show me recent CRITICAL GHSAs for npm","Search GHSA advisories about prototype pollution","List GHSA-only vulnerabilities (no CVE assigned) from the last 30 days","Show me HIGH-severity Python package vulnerabilities"],"description":"Search GHSA advisories by keyword, severity, ecosystem, or publication date. Returns summary, severity, affected ecosystems, linked CVEs."},{"id":"cve-to-packages","name":"CVE to Affected Packages","tags":["cve","packages","ghsa","supply-chain","remediation"],"examples":["Which packages are affected by CVE-2021-44228?","Show me the package versions vulnerable to CVE-2022-22965"],"description":"Given a CVE ID, return the open-source packages affected via its GitHub Security Advisory alias. Returns ecosystem, package name, vulnerable range, fixed version."},{"id":"capec-lookup","name":"CAPEC Attack Pattern Detail","tags":["capec","attack-pattern","cwe","adversary-modelling","threat-modelling"],"examples":["Show me CAPEC-66 SQL Injection","What are the prerequisites for CAPEC-112 Brute Force?","Which ATT&CK techniques map to CAPEC-206?","What mitigations exist for CAPEC-63 Cross-Site Scripting?"],"description":"Get a specific MITRE CAPEC attack pattern (CAPEC-N) with full taxonomy: description, abstraction (Meta/Standard/Detailed), severity, likelihood, prerequisites, skills required, resources required, consequences, example instances, linked CWEs, mapped ATT&CK techniques, mitigations, and related patterns (ChildOf/ParentOf/CanPrecede/CanFollow). 615 patterns from the CAPEC STIX 2.1 corpus."},{"id":"capec-search","name":"Search CAPEC Attack Patterns","tags":["capec","attack-pattern","search","threat-modelling"],"examples":["List all Very High severity CAPEC patterns","Show me CAPEC patterns about injection","Which Standard-abstraction patterns have High likelihood?","Find CAPEC patterns related to authentication bypass"],"description":"Search/filter CAPEC attack patterns by keyword, abstraction level (Meta, Standard, Detailed), severity (Very Low..Very High), or likelihood (Low, Medium, High). Returns CAPEC ID, name, taxonomy fields, CWE references, and technique/mitigation counts."},{"id":"advisories-search","name":"Unified Advisories Search","tags":["advisories","ghsa","osv","vulnerabilities","linux","debian","ubuntu","alpine","android","kernel","distros"],"examples":["Show me HIGH advisories on Debian this month","Find OSV advisories for the Linux kernel with CVE aliases","List CRITICAL GHSA advisories for npm in the last 7 days","Which Alpine advisories reference CVE-2024-1086?","Show all OS/distro advisories affecting openssl","What advisories apply to Android in 2024?"],"description":"Search across GHSA (GitHub Security Advisories — OSS packages: npm/PyPI/Maven/Go/NuGet/RubyGems/Composer/crates.io/Pub/Hex) AND OSV (OS + distro + kernel: Linux kernel, Debian, Ubuntu, Alpine, Android, Red Hat, Rocky Linux, AlmaLinux, SUSE, openSUSE, OSS-Fuzz, Bitnami, Chainguard, Wolfi, Hackage, CRAN, Julia). Filter by source, severity, ecosystem, date range, or CVE-alias presence. Returns one row per advisory with a source badge — no duplicates: our OSV ingest skips GHSA-covered ecosystems at fetch time and drops records aliasing existing GHSA rows."},{"id":"osv-lookup","name":"OSV Advisory Detail","tags":["osv","advisory","linux","debian","ubuntu","alpine","android","kernel","distros"],"examples":["Show me DSA-5678-1 (Debian Security Advisory)","What packages are affected by USN-6543-1?","Get the OSV record for a Linux kernel CVE","Which Alpine packages are vulnerable per ALAS-2024-0001?"],"description":"Get full details for an OSV advisory (OS / distro / kernel) by native ID (DSA-*, USN-*, LBSEC-*, ALAS-*, KERN-*, RLSA-*, etc.): summary, description, aliases (CVE/GHSA), CVSS score + vector, affected packages grouped by ecosystem with vulnerable version ranges. Source: osv.dev — ingested daily with 7-day rolling delta and monthly full reconcile."},{"id":"compliance-frameworks","name":"Compliance Frameworks (SCF-backed)","tags":["compliance","regulatory","scf","nis2","dora","pci-dss","iso-27002","hipaa","gdpr","nist-800-53","cmmc","fedramp","nerc-cip","iec-62443","owasp-top-10","eu-ai-act","eu-cra","grc"],"examples":["Which compliance frameworks cover T1059?","What ATT&CK techniques does EU NIS2 require coverage on?","Show me the DORA articles that map to credential-access techniques","Which framework has the broadest ATT&CK coverage?","List all EU regulatory frameworks tracked","Compare NIS2 and DORA coverage overlap"],"description":"Bridge between MITRE ATT&CK and regulatory / audit frameworks via the Secure Controls Framework (SCF). Cross-walks 240+ frameworks — NIS2, DORA, PCI DSS v4, ISO 27002:2022, HIPAA Security Rule, GDPR, NIST 800-53 r5, NIST CSF v2, CMMC 2.0, FedRAMP r5, NERC CIP, IEC 62443, UK Cyber Essentials, AU Essential Eight, NIST AI RMF, EU CRA, EU AI Act, OWASP Top 10, and more — to ATT&CK techniques. Answer GRC questions like 'which techniques does NIS2 cover?' or 'if I mitigate T1059, which compliance regimes do I satisfy?'. Each framework rolls up to 1,591 SCF controls with article/section-level cross-references. Checked monthly; SCF itself releases twice a year. Powered by SCF — CC BY-ND 4.0."},{"id":"ics-assets-purdue","name":"ICS Assets and Purdue Model","tags":["ics","ics-asset","purdue","ot","isa-95"],"examples":["Which ICS assets sit in the industrial DMZ?","Which techniques target A0001 Workstation?","Can traffic go from L4 straight to L2 on the Purdue model?","List the assets at Purdue level 1"],"description":"The 18 ATT&CK for ICS assets (A0001 to A0018: PLCs, RTUs, safety controllers, historians, HMIs, workstations, field I/O), the ICS techniques that target each, and their place on the Purdue model: levels L0 to L5, the industrial DMZ at L3.5 and the 42 level-to-level flows. Searched by name, Purdue level, zone, sector or IT/OT boundary. The Purdue placement is curated from NIST SP 800-82r3 and ISA-95, not published by MITRE."}],"version":"1.0.0","provider":{"url":"https://mitre-explorer.org","organization":"MITRE Explorer"},"description":"Threat intelligence agent for MITRE ATT&CK, ATLAS, CVE vulnerabilities, and application security. Query techniques, threat groups, campaigns, software, CVEs (with EPSS exploit-probability scoring), CAPEC attack patterns, GHSA + OSV advisories (OSS packages, OS, distros, kernel, Android), detection strategies, and compliance mappings across Enterprise, ICS, Mobile, and ATLAS domains. The same tools are also served over MCP at https://mitre-explorer.org/api/mcp: no key, no sign-up, no fixed rate limit.","capabilities":{"streaming":false,"extensions":[{"uri":"https://mitre-explorer.org/a2a/rate-limiting","params":{"rateLimitBy":"ip","retryAfterHeader":true,"maxRequestsPerDay":50},"required":false,"description":"Rate limited to 50 requests per day per IP. A refused request gets HTTP 429 and a Retry-After header."},{"uri":"https://mitre-explorer.org/a2a/data-sources","params":{"sources":["MITRE ATT&CK STIX (v20.0 — Enterprise, ICS, Mobile)","MITRE ATLAS (v1.0 — AI/ML threats)","CVElistV5 and NVD (more than 398,000 CVEs, 1999 on)","CISA KEV (Known Exploited Vulnerabilities)","NVD (CVSS enrichment)","EPSS (First.org exploit-probability scoring, daily refreshed, more than 398,000 scored CVEs)","OSV (Open Source Vulnerabilities — non-GHSA ecosystems: Linux kernel, Debian, Ubuntu, Alpine, Android, Red Hat, Rocky Linux, AlmaLinux, SUSE, openSUSE, openEuler, OSS-Fuzz, Bitnami, Chainguard, Wolfi, Hackage, CRAN, Julia, GHC, SwiftURL. Daily 7-day delta + monthly full reconcile. Disjoint from GHSA by ingest-time filter.)","CAPEC STIX 2.1 (about 560 active attack patterns with full taxonomy: prerequisites, skills, consequences, mitigations, related patterns; also used as CWE→CAPEC→ATT&CK bridge)","CTID (hand-curated CVE→technique mappings)","SigmaHQ (3,100+ detection rules)","Atomic Red Team (1,900+ tests)","D3FEND (156 countermeasures, 5,772 mappings to live ATT&CK techniques)","NIST 800-53 (5,200+ controls)","AlienVault OTX (threat reports + IOCs)","ETDA/ThaiCERT (more than 500 external actors)","MITRE Engage, RE&CT, VERIS, Azure/GCP cloud controls","CIS Controls v8.1 (8.1.2) and CIS Community Defense Model (CDM) v3.0 (CC BY-NC-ND 4.0, non-commercial use only, attribution required): 153 Safeguards, 108 mapped to ATT&CK Enterprise v16.1","Secure Controls Framework — SCF (CC BY-ND 4.0, checked monthly) — 1,591 controls cross-mapped to 240+ compliance and regulatory frameworks (NIS2, DORA, PCI DSS, ISO 27002, HIPAA, GDPR, NIST 800-53 r5, CMMC 2, FedRAMP, NERC CIP, IEC 62443, UK Cyber Essentials, AU Essential Eight, NIST AI RMF, OWASP Top 10 and more). Backs /compliance/* and per-entity compliance shadow panels."]},"required":false,"description":"The sources behind the answers, with versions and sizes."},{"uri":"https://mitre-explorer.org/a2a/presentation-hints","params":{"baseUrl":"https://mitre-explorer.org","example":"When listing CVEs, render each as a clickable link: [CVE-2024-3400](https://mitre-explorer.org/cti/cves/CVE-2024-3400). For techniques: [T1059](https://mitre-explorer.org/techniques/T1059). For groups: [APT29 (G0016)](https://mitre-explorer.org/groups/G0016). For sectors: [Financial](https://mitre-explorer.org/sectors/financial). For applications: [LiteLLM](https://mitre-explorer.org/?entity=litellm%2Flitellm&tab=application-map). For CAPEC patterns: [CAPEC-66 SQL Injection](https://mitre-explorer.org/cti/capec/CAPEC-66). For GHSA advisories: [GHSA-jfh8-c2jp-5v3q](https://mitre-explorer.org/cti/ghsa/GHSA-jfh8-c2jp-5v3q). For OSV advisories: [DSA-5678-1](https://mitre-explorer.org/cti/osv/DSA-5678-1). For unified advisories list: [OSS advisories](https://mitre-explorer.org/cti/advisories?source=GHSA) or [OS/distro advisories](https://mitre-explorer.org/cti/advisories?source=OSV).","entityUrls":{"matrix":"/matrix?domain={domain}","cve_list":"/cti/cves?q={query}&since={isoDate}","dashboard":"/dashboard?domain={domain}","ghsa_list":"/cti/ghsa?q={query}&since={isoDate}","group_360":"/groups/{attackId}","hunt_card":"/techniques/{attackId}/hunt","capec_list":"/cti/capec?q={query}","cve_detail":"/cti/cves/{cveId}","osv_detail":"/cti/osv/{osvId}","sector_360":"/?entity={sectorSlug}&tab=sector-map","ghsa_detail":"/cti/ghsa/{ghsaId}","asset_detail":"/assets/{assetId}","capec_detail":"/cti/capec/{capecId}","group_detail":"/groups/{attackId}","owasp_detail":"/frameworks/owasp/{categoryId}","package_list":"/packages","purdue_model":"/frameworks/purdue","sector_detail":"/sectors/{sectorSlug}","tactic_detail":"/tactics/{attackId}","technique_360":"/?entity={attackId}&tab=technique-map","compliance_hub":"/compliance","package_detail":"/packages/{ecosystem}/{encodedName}","advisories_list":"/cti/advisories?q={query}&source={GHSA|OSV}&severity={CRITICAL|HIGH|MEDIUM|LOW}&ecosystem={ecosystem}&since={isoDate}","application_360":"/?entity={vendor}%2F{product}&tab=application-map","campaign_detail":"/campaigns/{attackId}","matrix_filtered":"/matrix?entity={attackId}&type={entityType}&label={name}","software_detail":"/software/{attackId}","application_list":"/applications","technique_detail":"/techniques/{attackId}","mitigation_detail":"/mitigations/{attackId}","data_source_detail":"/data-sources/{attackId}","compliance_framework":"/compliance/{frameworkKey}"},"description":"When presenting results to your user, include clickable links to MITRE Explorer for each entity mentioned. Use the URL patterns below. Cite an entity by its detail page (technique_detail, group_detail, sector_detail and so on): the technique_360, application_360 and sector_360 patterns open the interactive map on the home page, whose title does not name the entity. Format results as structured tables or lists with severity color-coding.","entityColors":{"cve":"#f472b6","osv":"#eab308","capec":"#eab308","group":"#f97316","advisory":"#f472b6","campaign":"#60a5fa","software":"#a78bfa","technique":"#0d9488","mitigation":"#34d399","application":"#3b82f6","data_source":"#94a3b8"},"severityColors":{"LOW":"#60a5fa","HIGH":"#f97316","MEDIUM":"#facc15","CRITICAL":"#db2777"}},"required":false,"description":"Link patterns and colors for showing results to a person."}],"pushNotifications":false},"authentication":{"schemes":[]},"protocolVersion":"0.3","documentationUrl":"https://mitre-explorer.org","defaultInputModes":["text/plain"],"defaultOutputModes":["application/json","text/plain"],"preferredTransport":"JSONRPC","supportedInterfaces":[{"url":"https://mitre-explorer.org/api/a2a","protocolBinding":"JSONRPC","protocolVersion":"1.0"},{"url":"https://mitre-explorer.org/api/a2a","protocolBinding":"JSONRPC","protocolVersion":"0.3"}]},"status":"verified","publisher_domain":"mitre-explorer.org","signature_status":"unsigned","signature_detail":"No card signature supplied","signature_key_url":null,"signature_checked_at":"2026-11-09T22:36:48.317556+00:00","domain_claimed_at":null,"domain_proof_checked_at":null,"source_name":"Publisher Agent Card","source_url":"https://mitre-explorer.org/.well-known/agent-card.json","last_check":{"checked_at":"2026-11-09T22:36:48.317556+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"also_published_at":[],"history_urls":["https://mitre-explorer.org/.well-known/agent-card.json"],"skills":[{"skill_id":"data-source-profile","name":"ATT&CK Data Source Profile","description":"One ATT&CK data source: its description, its data components and the techniques it can detect. ATT&CK has marked every data source deprecated since v18. Components are matched to their source by name.","tags":["data-source","data-component","detection","telemetry"],"quality_warning":false},{"skill_id":"attack-statistics","name":"ATT&CK Statistics","description":"ATT&CK in numbers: technique, group, software, campaign, mitigation and data source counts, the top groups, the ten techniques live groups use most, the sector breakdown and the loaded ATT&CK version. Filtered by domain or sector. ATT&CK entities only: no CVE, advisory or CAPEC totals.","tags":["dashboard","statistics","attack","overview"],"quality_warning":false},{"skill_id":"tactic-profile","name":"ATT&CK Tactic Profile","description":"One ATT&CK tactic: its description, its domain and every live technique and sub-technique under it. Deprecated tactics are flagged.","tags":["tactic","attack","technique"],"quality_warning":false},{"skill_id":"technique-intelligence","name":"ATT&CK Technique Intelligence","description":"Get detailed intelligence on ATT&CK and ATLAS techniques: threat groups using them, Sigma detection rules, Atomic Red Team tests, D3FEND countermeasures, affected applications, NIST 800-53 control mappings, and CAPEC attack patterns mapped to the technique.","tags":["technique","attack","atlas","detection","sigma","d3fend","capec"],"quality_warning":false},{"skill_id":"application-security","name":"Application Vulnerability Assessment","description":"Check the security posture of more than 119,000 vendor products. Returns CVEs, CWE weakness profile, reachable ATT&CK techniques, and associated threat groups via the CVE-CWE-CAPEC-ATT&CK chain.","tags":["application","software","cpe","vulnerability","attack-surface"],"quality_warning":false},{"skill_id":"atomic-red-team","name":"Atomic Red Team Tests","description":"Search 1,900+ Atomic Red Team tests for adversary emulation. Filter by technique, platform, and executor type.","tags":["atomic","red-team","emulation","testing"],"quality_warning":false},{"skill_id":"capec-lookup","name":"CAPEC Attack Pattern Detail","description":"Get a specific MITRE CAPEC attack pattern (CAPEC-N) with full taxonomy: description, abstraction (Meta/Standard/Detailed), severity, likelihood, prerequisites, skills required, resources required, consequences, example instances, linked CWEs, mapped ATT&CK techniques, mitigations, and related patterns (ChildOf/ParentOf/CanPrecede/CanFollow). 615 patterns from the CAPEC STIX 2.1 corpus.","tags":["capec","attack-pattern","cwe","adversary-modelling","threat-modelling"],"quality_warning":false},{"skill_id":"cve-lookup","name":"CVE Vulnerability Lookup","description":"Search and retrieve CVE vulnerability details including CVSS scores, severity, CWEs, EPSS exploit-probability scores (First.org, daily refreshed), CAPEC attack patterns, affected applications, linked ATT&CK techniques, CISA KEV status, GHSA package advisories, and OSV OS/distro advisories (Linux kernel, Debian, Ubuntu, Alpine, Android, Rocky, Alma, SUSE, OSS-Fuzz) that alias the CVE. Covers more than 398,000 CVEs, 1999 on.","tags":["cve","vulnerability","security","cvss","epss","capec","osv","cisa-kev"],"quality_warning":false},{"skill_id":"cve-to-packages","name":"CVE to Affected Packages","description":"Given a CVE ID, return the open-source packages affected via its GitHub Security Advisory alias. Returns ecosystem, package name, vulnerable range, fixed version.","tags":["cve","packages","ghsa","supply-chain","remediation"],"quality_warning":false},{"skill_id":"campaign-intelligence","name":"Campaign Intelligence","description":"Search and analyze 61 named campaigns with timelines, techniques, software, and threat groups involved.","tags":["campaign","operation","timeline"],"quality_warning":false},{"skill_id":"compliance-frameworks","name":"Compliance Frameworks (SCF-backed)","description":"Bridge between MITRE ATT&CK and regulatory / audit frameworks via the Secure Controls Framework (SCF). Cross-walks 240+ frameworks — NIS2, DORA, PCI DSS v4, ISO 27002:2022, HIPAA Security Rule, GDPR, NIST 800-53 r5, NIST CSF v2, CMMC 2.0, FedRAMP r5, NERC CIP, IEC 62443, UK Cyber Essentials, AU Essential Eight, NIST AI RMF, EU CRA, EU AI Act, OWASP Top 10, and more — to ATT&CK techniques. Answer GRC questions like 'which techniques does NIS2 cover?' or 'if I mitigate T1059, which compliance regimes do I satisfy?'. Each framework rolls up to 1,591 SCF controls with article/section-level cross-references. Checked monthly; SCF itself releases twice a year. Powered by SCF — CC BY-ND 4.0.","tags":["compliance","regulatory","scf","nis2","dora","pci-dss","iso-27002","hipaa","gdpr","nist-800-53","cmmc","fedramp","nerc-cip","iec-62443","owasp-top-10","eu-ai-act","eu-cra","grc"],"quality_warning":false},{"skill_id":"entity-search","name":"Cross-Domain Entity Search","description":"Search across all entity types (techniques, groups, software, campaigns, mitigations, data sources, applications) in all domains (Enterprise, ICS, Mobile, ATLAS).","tags":["search","entity","cross-domain"],"quality_warning":false},{"skill_id":"detection-search","name":"Detection & Compliance Search","description":"Search Sigma rules (3,100+), Atomic Red Team tests (1,900+), D3FEND countermeasures (156), NIST 800-53 controls (5,200+), MITRE Engage mappings, VERIS mappings, and cloud security controls for Azure and GCP. Lists CIS Controls v8.1 (8.1.2) Safeguards with their Implementation Groups, as CIS maps them to ATT&CK in the CIS Community Defense Model (CDM) v3.0, and the CIS gaps of an ATT&CK group or technique list: each technique under the lowest Implementation Group whose Safeguards mitigate it, else notMitigated or notAssessed. CIS text and CIS's ATT&CK mapping: CC BY-NC-ND 4.0, non-commercial use only, attribution required. CIS titles and descriptions are served exactly as the CDM v3.0 workbook writes them; cisSource carries the source, license and attribution.","tags":["sigma","detection","nist","compliance","d3fend","atomic","cis-controls"],"quality_warning":false},{"skill_id":"external-actors","name":"External Threat Actor Profiles","description":"Search more than 500 threat actors from ETDA/ThaiCERT with country attribution, state sponsors, motivation, suspected victims, and MITRE ATT&CK group mappings.","tags":["actor","attribution","country","state-sponsor"],"quality_warning":false},{"skill_id":"ghsa-lookup","name":"GitHub Security Advisory Detail","description":"Get full details for a GitHub Security Advisory: summary, description, CVSS v3/v4, CWEs, CAPEC attack patterns, affected open-source packages with vulnerable/fixed version ranges, linked ATT&CK techniques.","tags":["ghsa","github","advisory","appsec","vulnerabilities","supply-chain","capec"],"quality_warning":false},{"skill_id":"ics-assets-purdue","name":"ICS Assets and Purdue Model","description":"The 18 ATT&CK for ICS assets (A0001 to A0018: PLCs, RTUs, safety controllers, historians, HMIs, workstations, field I/O), the ICS techniques that target each, and their place on the Purdue model: levels L0 to L5, the industrial DMZ at L3.5 and the 42 level-to-level flows. Searched by name, Purdue level, zone, sector or IT/OT boundary. The Purdue placement is curated from NIST SP 800-82r3 and ISA-95, not published by MITRE.","tags":["ics","ics-asset","purdue","ot","isa-95"],"quality_warning":false},{"skill_id":"ioc-feed","name":"IOC Feed Search","description":"Search more than 230,000 IOCs (IPs, domains, hashes, URLs, CVEs) with VirusTotal verdicts and malware family attribution. Sources: OTX, ThreatFox, MalwareBazaar, CISA KEV.","tags":["ioc","indicator","hash","ip","domain","virustotal"],"quality_warning":false},{"skill_id":"software-analysis","name":"Malware & Tool Analysis","description":"Search and profile 971 malware families and attacker tools. Get techniques, groups using them, campaigns, and platform coverage.","tags":["malware","tool","software","cobalt-strike"],"quality_warning":false},{"skill_id":"mitigation-guidance","name":"Mitigation Guidance","description":"Search 153 mitigations and get specific countermeasure guidance for ATT&CK techniques.","tags":["mitigation","defense","countermeasure"],"quality_warning":false},{"skill_id":"osv-lookup","name":"OSV Advisory Detail","description":"Get full details for an OSV advisory (OS / distro / kernel) by native ID (DSA-*, USN-*, LBSEC-*, ALAS-*, KERN-*, RLSA-*, etc.): summary, description, aliases (CVE/GHSA), CVSS score + vector, affected packages grouped by ecosystem with vulnerable version ranges. Source: osv.dev — ingested daily with 7-day rolling delta and monthly full reconcile.","tags":["osv","advisory","linux","debian","ubuntu","alpine","android","kernel","distros"],"quality_warning":false},{"skill_id":"owasp-top10","name":"OWASP Top 10 Analysis","description":"Get OWASP Top 10 categories for Web (2021), ML (2023), and LLM (2025) security risks mapped to ATT&CK + ATLAS techniques via CWE.","tags":["owasp","top10","web-security","appsec","compliance","ml-security","llm-security","ai-risks"],"quality_warning":false},{"skill_id":"package-vulnerabilities","name":"Package Vulnerabilities","description":"List vulnerabilities affecting a specific open-source package in an ecosystem (npm, pypi, go, maven, rubygems, nuget, composer, rust). Returns all GHSAs with vulnerable/fixed version ranges and linked ATT&CK techniques.","tags":["packages","npm","pypi","go","maven","supply-chain","appsec","vulnerabilities"],"quality_warning":false},{"skill_id":"capec-search","name":"Search CAPEC Attack Patterns","description":"Search/filter CAPEC attack patterns by keyword, abstraction level (Meta, Standard, Detailed), severity (Very Low..Very High), or likelihood (Low, Medium, High). Returns CAPEC ID, name, taxonomy fields, CWE references, and technique/mitigation counts.","tags":["capec","attack-pattern","search","threat-modelling"],"quality_warning":false},{"skill_id":"ghsa-search","name":"Search GitHub Security Advisories","description":"Search GHSA advisories by keyword, severity, ecosystem, or publication date. Returns summary, severity, affected ecosystems, linked CVEs.","tags":["ghsa","github","advisory","search","vulnerabilities"],"quality_warning":false},{"skill_id":"sector-threat-landscape","name":"Sector Threat Landscape","description":"Analyze threats to industry sectors: groups targeting the sector, their techniques, campaigns, vulnerable applications, and associated CVEs. Covers 12 sectors including Financial, Healthcare, Government, Energy, Telecom.","tags":["sector","industry","threat-landscape"],"quality_warning":false},{"skill_id":"sigma-rules","name":"Sigma Detection Rules","description":"Search 3,100+ Sigma rules by keyword, technique, or severity. Get YAML rule details for SIEM deployment.","tags":["sigma","detection","siem","rule"],"quality_warning":false},{"skill_id":"threat-group-profile","name":"Threat Group Profile","description":"Retrieve threat actor group profiles with their techniques, targeted sectors, software used, campaigns, and targeted applications. Covers more than 180 ATT&CK groups plus more than 500 ETDA/ThaiCERT external actors.","tags":["threat-group","apt","adversary","actor"],"quality_warning":false},{"skill_id":"hunt-card","name":"Threat Hunting Card","description":"One hunting card per ATT&CK technique: a starting hypothesis built from ATT&CK data by a fixed template, the logs to collect, detection strategies and analytics, the top Sigma rules, one Atomic Red Team test to check the detection, indicators from the last 14 days and recent reports. A parent technique includes its sub-techniques. ATT&CK techniques only, not ATLAS.","tags":["hunt","threat-hunting","detection","sigma","atomic","soc"],"quality_warning":false},{"skill_id":"cti-reports","name":"Threat Intelligence Reports","description":"Access recent CTI reports from AlienVault OTX, DFIR Report, Unit42, Microsoft Security, and Talos. Reports are mapped to ATT&CK techniques with IOC indicators.","tags":["cti","threat-report","otx","ioc"],"quality_warning":false},{"skill_id":"advisories-search","name":"Unified Advisories Search","description":"Search across GHSA (GitHub Security Advisories — OSS packages: npm/PyPI/Maven/Go/NuGet/RubyGems/Composer/crates.io/Pub/Hex) AND OSV (OS + distro + kernel: Linux kernel, Debian, Ubuntu, Alpine, Android, Red Hat, Rocky Linux, AlmaLinux, SUSE, openSUSE, OSS-Fuzz, Bitnami, Chainguard, Wolfi, Hackage, CRAN, Julia). Filter by source, severity, ecosystem, date range, or CVE-alias presence. Returns one row per advisory with a source badge — no duplicates: our OSV ingest skips GHSA-covered ecosystems at fetch time and drops records aliasing existing GHSA rows.","tags":["advisories","ghsa","osv","vulnerabilities","linux","debian","ubuntu","alpine","android","kernel","distros"],"quality_warning":false}],"quality_flags":[],"check_history":{"checks":1,"passed":1},"recent_checks":[{"card_url":"https://mitre-explorer.org/.well-known/agent-card.json","checked_at":"2026-11-09T22:36:48.317556+00:00","success":true,"http_status":200,"detail":"Agent Card validated"}],"endpoint_tls_check":{"checked_at":"2026-11-09T22:36:48.317556+00:00","success":true,"detail":"Valid TLS connection to advertised endpoint host; no A2A request sent"},"protocol_check":{"checked_at":"2026-11-09T22:36:48.317556+00:00","endpoint":"https://mitre-explorer.org/api/a2a","protocol_binding":"JSONRPC","protocol_version":"1.0","state":"a2a_response","http_status":200,"detail":"A2A task-not-found response to a read-only task lookup","request_diagnostics":{"requests":[{"path":"/api/a2a","allow":[],"method":"POST","status":200,"version_header":"1.0","protocol_method":"GetTask","redirect_followed":false}],"capture_version":1}},"declared_primary_endpoint":"https://mitre-explorer.org/api/a2a","selected_connection_interface":{"url":"https://mitre-explorer.org/api/a2a","protocolBinding":"JSONRPC","protocolVersion":"1.0"},"protocol_interface_checks":[{"endpoint":"https://mitre-explorer.org/api/a2a","protocol_binding":"JSONRPC","protocol_version":"1.0","selected":true,"state":"a2a_response","checked_at":"2026-11-09T22:36:48.317556+00:00","http_status":200,"detail":"A2A task-not-found response to a read-only task lookup","binding_recorded":true},{"endpoint":"https://mitre-explorer.org/api/a2a","protocol_binding":"JSONRPC","protocol_version":"0.3","selected":false,"state":"a2a_response","checked_at":"2026-11-09T22:36:48.317556+00:00","http_status":200,"detail":"A2A task-not-found response to a read-only task lookup","binding_recorded":true}],"connection_selection_note":"The selected connection uses an address advertised in the publisher card. Read-only observations do not establish task quality or safety.","x402_price_check":null,"events":[],"relationships":[],"verification":{"agent_card_url":"https://mitre-explorer.org/.well-known/agent-card.json","last_successful_card_check":"2026-11-09T22:36:48.317556+00:00","latest_card_check":{"checked_at":"2026-11-09T22:36:48.317556+00:00","success":true,"http_status":200,"detail":"Agent Card validated"},"signature_status":"unsigned","signature_checked_at":"2026-11-09T22:36:48.317556+00:00","task_endpoint_tested":true,"task_execution_tested":false,"endpoint_tls_checked_at":"2026-11-09T22:36:48.317556+00:00","endpoint_tls_reachable":true,"protocol_check_state":"a2a_response","protocol_checked_at":"2026-11-09T22:36:48.317556+00:00","provider_identity_verified":false,"domain_claimed_at":null,"domain_proof_checked_at":null},"synthetic_capability_tests":{"agent_id":584826,"status":"not_tested","reason_code":"not_yet_tested","consent_status":"not_confirmed","latest_observation_status":null,"last_checked_at":null,"fixture_version":"1","reference_demonstration":false,"scope":"A publisher-authorized synthetic test of a dedicated free test endpoint. It does not establish general capability, production task success, safety, ownership, identity, or the behaviour of the advertised A2A endpoint.","methodology_url":"https://localmark.ai/capability-tests","history":[]},"repair_links":{"agent_repair_url":"https://localmark.ai/agents/584826/repair","publisher_report_url":"https://localmark.ai/publishers/mitre-explorer.org/repair","diagnostics_json_url":"https://localmark.ai/publishers/mitre-explorer.org/repair/diagnostics.json","diagnostics_csv_url":"https://localmark.ai/publishers/mitre-explorer.org/repair/diagnostics.csv"},"_localmark":{"contribution":{"optional":true,"directory_access":"free","operator_authorization_required":true,"affects_rankings":false,"message":"LocalMark is free. Optional contributions help fund ongoing checks.","support_url":"https://localmark.ai/support","metadata_url":"https://localmark.ai/api/v1/support/contributions"}}}